NEW YORK STATE SECURITY BREACH REPORTING FORM 
Pursuant to the Information Security Breach and Notification Act 
(General Business Law §899-aa) 


Nam.e.and_3.ddreis_of Entity that owns or licenses the comp uterized data that was subject to the breach : 

GARVEY SCHUBERT BARER 

Street Address: 1191 SECOND AVENUE, SUITE 1800 
City: SEATTLE State: WASHINGTON Zip Code: 98100-2939 


Submitted bv : LUCINDA FERNALD Title: GENERAL COUNSEL Dated: 9/13/2018 

Firm Name (if other than entity): _ 

Telephone: 206-816-1323 Email: LFERNALD@GSBLAW.COM 

Relationship to Entity whose information was compromised: GENERAL COUNSEL 


Type of Organization (please select one): [ ] Governmental Entity in New York State; [ ] Other Governmental Entity; 
[ ] Educational; [ ]Health Care; [ ]Financial Services; [ X ]Other Commercial; or [ ]Not-for-profit. 


Number of Persons Affected : 

Total (Including NYS residents): 292 NYS Residents: 19 

If the number of NYS residents exceeds 5,000, have the consumer reporting agencies been notified? [ ] Yes [ | No 


Pates : Breach Occurred:10/21/2017 Breach Discovered 8/6/2018 Consumer Notification: 9/14/18 or 9/17/18 


Description of Breach (please select all that apply): 

[ ]Loss or theft of device or media (e.g., computer, laptop, external hard drive, thumb drive, CD, tape); 
[ JInternal system breach; [ X Jlnsider wrongdoing; [ ]External system breach (e.g., hacking); 

[ ]Inadvertent disclosure; [ JOther specify):_ 


Information Acquired : Name or other personal identifier in combination with (please select aM that apply): 

[ X JSocial Security Number 

[ ]Driver's license number or non-driver identification card number 

[ ]Financial account number or credit or debit card number, in combination with the security code, access code, 
password, or PIN for the account 


Manner of Notification to Affected Persons - ATTACH A COPY OF THE TEMPLATE OF THE NOTICE TO 
AFFECTED NYS RESIDENTS: 

[ X ] Written [ ] Electronic [ ] Telephone [ ) Substitute notice 

List dates of any previous (within 12 months) breach notifications: NONE 

Identify The ft Protection Service Offered .: I X ]Yes [ ) No 
Duration: 36 MONTHS Provider: ALL-CLEAR ID 

Brief Description of Service: (1) IDENTITY REPAIR; (2) FRAUD ALERTS WITH CREDIT MONITORING 
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PLEASE COMPLETE AND SUBMIT THIS FORM TO 
EACH OF THE THREE STATE AGENCIES LISTED BELOW: 


Fax or Email this form to: 

New York State Attorney General's Office 

SECURITY BREACH NOTIFICATION 

Consumer Frauds & Protection Bureau 

120 Broadway - 3 rd Floor 

New York, NY 10271 

Fax: 212-416-6003 

Email: breach.security@ag.ny.gov 

New York State Division of State Police 
SECURITY BREACH NOTIFICATION 
New York State Intelligence Center 
31 Tech Valley Drive, Second Floor 
East Greenbush, NY 12061 
Fax: 518-786-9398 
Email: risk@nvsic.ny.gov 

New York State Department of State Division of Consumer Protection 

Attention: Director of the Division of Consumer Protection 

SECURITY BREACH NOTIFICATION 

99 Washington Avenue, Suite 650 

Albany, New York 12231 

Fax: (518) 473-9055 

Email: security breach notification@dos.ny.gov 
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OTHER OFFICES 


S<4 

BJ 

garvey schubert barer 


A PROFESSIONAL SERVICE CORPORATION 


SEATTLE OFFICE 
second & senecu building 
1191 second avenue 
eighteenth floor 

Seattle, Washington 98101-2939 
’el 206 464 3939 fax 206 464 0125 


porllond. Oregon 
Washington, d.c. 
new york, new york 
beijing. r h ina 
GSBuaw. COM 


Please reply to DONALD B. SCARAMASTRA 
dscarl&gsblaw. com 
206 816 1449 

[Date] 

[Name] 

[Address] 

[Address] 

Re: Notice of Data Breach 


Dear_: 

What Happened: Last month we learned that a former attorney had accessed a document containing 
sensitive personal information (identified below) of many current and former employees and without 
authorization exported it from iManage on October 21, 2017. We have been told the former attorney 
destroyed the document, and we have no reason to believe the former attorney used the information in 
a way that would harm any current or former employees. We will continue our investigation and will send 
an update if we learn additional information relevant to the security of your personal information. This 
notice was not delayed by a law enforcement investigation. 

Who Was Affected: The individuals affected were employees on Garvey Schubert Barer's payroll between 
January 1, 2016 and December 1, 2016. If you are receiving this notice, then your information (described 
below) was included in the document exported by the former attorney. 

What Information Was Involved: The document concerned Garvey Schubert Barer's 2016 matching 
401(k) contribution. It contained the following data: full name, social security number, date of birth, 
address, date of hire, gross pay, and amount of 401(k) contribution. 

What We Are Doing: In addition to continuing our investigation, we are taking steps to prevent a similar 
incident by providing additional training to administrative personnel regarding procedures for securing 
documents and by implementing a new tool within iManage to alert firm management of unusual activity 
that may signal an internal security threat. We are also offering identity theft prevention and mitigation 
services as described below. 

What You Can Do - Generally: We recommend that you exercise vigilance concerning the potential for 
identity theft by reviewing account statements and monitoring free credit reports. We also recommend 
that you report any suspected identity theft to law enforcement, including the Federal Trade Commission 
and your state Attorney General. Contact information is enclosed, and you can obtain additional 
information from these sources about steps to protect your identity. 

What You Can Do - Enroll with AllClear ID: As an added precaution, we have arranged to have AllClear ID 
protect your identity for 36 months at no cost to you. The following identity protection services start on the 
date of this notice and you can use them at any time during the next 36 months. 
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AllClear Identity Repair: This service is automatically available to you with no enrollment required. 
If a problem arises, simply call 1-866-979-2595 and a dedicated investigator will help recover 
financial losses, restore your credit and make sure your identity is returned to its proper condition. 

AllClear Fraud Alerts with Credit Monitoring: This service offers the ability to set, renew, and remove 
90-day fraud alerts on your credit file to help protect you from credit fraud. In addition, it provides 
credit monitoring services, a once annual credit score and credit report, and a $1 million identity 
theft insurance policy. To enroll in this service, you will need to provide your personal information to 
AllClear ID. You may sign up online at enroll.allclearid.co m or by phone by calling 1-866-979-2595 
using the following redemption code: |Redempij^nCbde). 

Please note: Following enrollment, additional steps are required by you in order to activate your 
phone alerts and fraud alerts, and to pull your credit score and credit file. Additional steps may also 
be required in order to activate your monitoring options. 

Other Important Information: The enclosed document, "Steps You Can Take to Protect Your Personal 
Information and Avoid Identity Theft, provides information regarding identity theft generally and contact 
information for a variety of resources. 

For More Information: If you have questions, contact Jennifer Poole at jpoole(5)esblaw.com or by phone 
at 206-816-1478 (toll free at 888-768-5939) or by letter at the Seattle office address above. 

We sincerely apologize for this incident. We know the security of your personal information is very 
important, and we will do our best to protect it. 

Sincerely, 

GARVEY SCHUBERT BARER 


By 

Donald B. Scaramastra, Co-Chair of the 401(k) Plan Administration Committee 


Enclosure 





STEPS YOU CAN TAKE TO PROTECT YOUR PERSONAL INFORMATION AND AVOID IDENTITY THEFT 


Review Your Account Statements and Notify Law Enforcement of Suspicious Activity: Asa precautionary 
measure, we recommend that you remain vigilant and review your account statements and credit reports 
closely. If you detect any suspicious activity on an account, you should promptly notify the financial 
institution or company with which the account is maintained. You should also promptly report any 
fraudulent activity or any suspected identity theft to local law enforcement authorities, your state 
Attorney General, and/or the Federal Trade Commission (the "FTC"). See below for contact information. 

Copy of Credit Report: You may obtain a free copy of your credit report from each of the three major 
credit reporting agencies once every 12 months by visiting https://www.annualcreditreport.com. calling 
toll-free 877-322-8228, or by completing an Annual Credit Report Request Form and mailing it to Annual 
Credit Report Request Service, P.O. Box 105281, Atlanta, GA 30348. You can also contact these national 
consumer credit reporting agencies: 


Equifax 

Experian 

TransUnion 

P.O. Box 105851 

P.O. Box 9701 

P.O. Box 1000 

Atlanta, GA 30348 

Allen, TX 75013 

Chester, PA 19016 

Credit Report 1-800-685-1111 

1-888-397-3742 

Credit Report 1-800-888-4213 

Fraud Alert 1-800-525-6285 

www.experian.com 

Fraud Alert 1-800-680-7289 

www.equifax.com 


www.transunion.com 


Fraud Alert: You may want to consider placing a fraud alert on your credit report. An initial fraud alert is 
free and will stay on your credit file for at least 90 days. The alert informs creditors of possible fraudulent 
activity within your report and requests that the creditor contact you prior to establishing any accounts 
in your name. To place a fraud alert on your credit report, contact any of the three credit reporting 
agencies identified above. Additional information is available at https://www.annualcreditreport.com . 

Security Freeze: In some states you have the right to put a security freeze on your credit file, which will 
prevent new credit from being opened in your name without the use of a PIN number that is issued to 
you when you initiate the freeze. A security freeze is designed to prevent potential creditors from 
accessing your credit report without your consent. As a result, it may interfere with or delay your ability 
to obtain credit. You must place a separate security freeze with each consumer credit reporting agency. 
There may be a fee up to $10 to place, lift or remove the security freeze. In addition, you may be required 
to provide identifying information such as your full name, social security number, date of birth, current 
and previous addresses, a copy of your state-issued identification card, or other information. 

Additional Free Resources: You may obtain information from the consumer credit reporting agencies, the 
FTC or from your state Attorney General about steps you can take to prevent identity theft. You may 
report suspected identity theft to local law enforcement, the FTC or the Attorney General in your state. 
Contact information is provided below. More information about identity theft is available at these sites: 
https://www.transunion.com/identitv-theft: httpsV/www.experian.com/'ologs/ask-experian/identitv- 

theft-statistics/; and https://www.consumer.ftc.gov/topics/identitv-theft . 

You also have certain rights under the Fair Credit Reporting Act (FCRA): These rights include knowing 
what is in your credit file; disputing incomplete or inaccurate information; and requiring consumer 
reporting agencies correct or delete inaccurate, incomplete, or unverifiable information. For more 
information, please visit https://www.consumer.ftc.gov/articles/pdf-0Q96-fair-credit-reporting-act.pdf . 









Note: We are required by statutes in most of the states below to provide contact information for national 
consumer credit reporting agencies and other resources. However, the most secure practice for an 
individual notified of a data breach is to verify such contact information independently. The reason is that 
some criminals send out fraudulent data breach notices directing recipients to contact their own websites 
or call centers, which then gather information to steal identities. 

Contact Information for Other Resources 


Federal Trade Commission 
Bureau of Consumer Protection 
600 Pennsylvania Ave., NW 
Washington, DC 20580 
https://www.ftccomplaintassistant.eov 
Telephone: (202) 326-2222 


Attorney General's Offices 


Alaska 

Alaska Attorney General's Office 

1031 West 4th Avenue, Suite 200 

Anchorage, AK 99501 
http://www.law.state.ak.us/ 

New Jersey 

State of New Jersey Department of Law & Public 
Safety 

Office of the Attorney General 

Richard J. Hughes Justice Complex 

8th Floor, West Wing 

25 Market Street 

Trenton, NJ 08625-0080 
htios://www. ni.gov/oag/ 

Main Number: 609-292-4925 

Phone: (907) 269-5100 / TTY: 907-258-9161 
Consumer Protection Unit (Toll-free outside 
Anchorage): 1-888-576-2529 

California 

Attorney General's Office 

California Department of Justice 

Attn: Public Inquiry Unit 

P.O. Box 944255 

Sacramento, CA 94244-2550 
https://oaR.ca.gov/home 

Public Inquiry Unit Voice: (916) 210-6276 

Toll-free in California: (800) 952-5225 

New York 

Office of the Attorney General 

The Capitol 

Albany, NY 12224-0341 
https://ag.ny.gov/ 

General Helpline: 1-800-771-7755 

District of Columbia 

Office of the Attorney General for the District of 
Columbia 

441 4th Street, NW 

Washington, DC 20001 
https://oag.dc.gov/ 

General Contact Phone: (202) 727-3400 

Office of Consumer Protection: (202) 442-9828 

Oregon 

Office of the Attorney General 

Oregon Department of Justice 

1162 Court St. NE 

Salem, OR 97301-4096 
https://www.doi.state.or.us/ 

Toll-Free Consumer Hotline: 1-877-877-9392 









Georgia 

Office of the Attorney General 
40 Capitol Square, SW 
Atlanta, GA 30334 
https://law.georeia.gov/ 
Phone: (404) 656-3300 


Maryland 

Maryland Attorney General 
200 St. Paul Place 
Baltimore, MD 21202 

http://www.marvlandattornevgeneral.gov/ 
Toll-free: 1-888-743-0023 
Identity Theft Unit: 410-576-6491 
Main Phone: 410-576-6300 


Virginia 

Office of the Attorney General 
202 North Ninth Street 
Richmond, Virginia 23219 
https://www.oag.state.va.us/ 

Main Phone: (804)786-2071 

Consumer Protection Hotline: 1-800-552-9963 if 

calling from Virginia 

Consumer Protection Hotline: (804) 786-2042 if 
calling from Richmond or from outside Virginia 


Washington 

Washington State Office of the Attorney General 

Consumer Protection 

800 5th Ave, Suite 2000 

Seattle, WA 98104-3188 

https://www.atg. wa.gov/ 

Toll Free: 1-800-551-4636 (in-state only) 

Phone: 1-206-464-6684 (out-of-state callers) 
l 


Maine 

Office of the Maine Attorney General 
6 State House Station 
Augusta, ME 04333 
https://www.maine.gov/ag/ 

Phone: 207-626-8800 


West Virginia 

Office of the WV Attorney General 
P.O. Box 1789, 

Charleston, WV 25326 
https://ago.wv.gov/Pages/default.aspx 
Toll-Free: 1-800-368-8808 
Phone: 304-558-8986 








